Alice finishes the backward pass.
How much security would Alice and Bob enjoy in this setting?
To answer this question, we have to consider the strongest realistic attack vector. In this work we assume that the adversary has access to everything but the missing parameters held by the other party. How easy would it be for this adversary to recover the missing part of the model?
We introduce this as the problem of model completion:
Given the entire training data set or an environment simulator, and a subset of the parameters of a trained model,
how much training is required to recover the model's original performance?
In this paper, we define the problem of model completion formally (ssec:problem-def), propose a metric to measure the hardness of model completion (ssec:hardness-def), and provide empirical results (sec:experimental-setup and ssec:experimental-results) in both the supervised learning (SL) and in reinforcement learning (RL). For our SL experiments we use the AlexNet convolutional network [1]} and the ResNet50 residual network [2]} on ImageNet [3]}; for RL we use A3C [4]} and Rainbow [5]} in the Atari domain [6]} and IMPALA [7]} on DeepMind Lab [8]}.
After training the model, we reinitialize one of the model's layers and measure how much training is required to complete it (see fig:model-completion-problem).
Our key findings are:
[label=(0)]

